Following the realistic setting discussed in [1]}, we assume that the malicious clients are the minority of the FL participants since the purpose of FL is to augment the training data and it is meaningless to lose trust among the majority of clients. Formally, our threat model contains a set of \(M\)  adversarial clients, where \(|M| = \alpha |N|\)  and \(0 < \alpha < 0.5\) . For every adversarial client, \(C^{\prime }_i\) , the attacker is able to add a trigger \(\delta \)  to every sample in its training set \(x\in \mathcal {D}_i\) . The goal of the attacker is to fool the central server generator to produce corrupted images that do not have medical research value.
